Marshal8e6 releases new insight, analysis into botnets
Study shows individual Xarvester and Rustock spambots capable of sending 25 000 messages per hour.
Marshal8e6, a global provider of Secure Web Gateway and e-mail security products, announced today the findings of its extensive botnet research conducted by the company's TRACElabs threat research group. The data, compiled during the first quarter of 2009, represents two years of in-depth research and observation, which provides detailed analysis of the inner workings of major botnets that Marshal8e6 has identified as the biggest spammers.
As part of the study's findings, TRACElabs determined that the Rustock and Xarvester malware provided the most efficient spambot code, enabling individual zombie computers to send 600 000 spam messages each over a 24-hour period.
"Over the past few years, botnets have revolutionised the spam industry and pushed spam volumes to epidemic proportions, despite the best efforts of law enforcement and the computer security industry. Our intention was to better understand the origins of spam, and the malware that drives it," said Phil Hay, senior threat analyst at Marshal8e6 TRACElabs.
TRACElabs deliberately infected its lab computers and observed the behaviour of the bot malware. Researchers looked at what changes it made to the registry, what ports it communicated over and observed how much spam each bot type was capable of sending.
The company's research extended to nine botnets that TRACElabs considered to be the largest spammers or the strongest up-and-comers, including: Xarvester, Mega-D, Gheg, Grum, Donbot, Pushdo, Bobax, Rustock and Waledac. These botnets collectively account for more than 70% of the world's total spam volume according to Marshal8e6.
Marshal8e6 will make the findings available on the company's TRACElabs Web site and will be updated on an ongoing basis.
"Results of our research provide our customers with optimum spam protection. Part of this research involves understanding the origins of spam and particularly botnets, which are the engines used to distribute most spam today. This helps us develop algorithms and processes which track spam according to the botnet it was sent from," explained Hay.
"By sharing our botnet research and highlighting the worst offenders, we hope to provide a resource that will aid other researchers in the fight against spam. One of our objectives over the past few years has been to emphasise the dominant role that a handful of key botnets play in the spam we see today," continued Hay. "Ultimately, we wish to focus the wider security community on the key botnets in the hopes that we can collectively pool our efforts to disrupt these botnets and reduce the overall volume of spam in circulation."
The results of the Marshal8e6 botnet research can be found at http://www.marshal8e6.com/trace/bot_statistics.asp.